4 



(19) 




Europaisches Patentamt 
European Patent Office 
Office europeen dee brevets 




(11) 



EP 0 824 742 B1 



(12) 



EUROPEAN PATENT SPECIFICATION 



(45) Date of publication and nnention 
o1 the grant of the patent: 
25.08.1999 Bulletin 1999/34 

(21) Applicatbn number: 96916070.4 

(22) Dateof filing: 10.05.1996 



(51) lntCI.6: G07F 7/10, G07F 19/00 

(86) International application number: 
PCT/EP96/02063 

(87) International publication number: 

WO 96/36026 (14.11.1996 Gazette 1996/50) 



(54) METHOD FOR EFFECTING AN ELECTRONIC PAYMENT TRANSACTION 

VERFAHREN ZUIVI DURCHFUHREN EINER ELEKTRONISCHEN ZAHLUNGSTRANSAKTION 
PROCEDE POUR EFFECTUER UNE TRANSACTION DU TYPE PAIEf\/1ENT ELECTRONIQUE 



CD 

CM 
00 



Q. 
LLI 



(84) Designated Contracting States: 

AT BE CH DE DK ES Fl FR QB GR IE IT LI LU NL 
PT SE 

(30) Priority: 11.05.1995 NL 1000341 
09.10.1995 NL 1001376 

(43) Date of publication of application: 
25.02.1998 Bulletin 1998/09 



(73) Proprietor: Konlnklljke KPN N.V. 
9726 AE Groningen (NL) 

(72) Inventor: PEDERSEN, Torben, R 
DK-8230 Abyho] (DK) 



(56) References cited: 
EP-A- 0 265 728 
EP-A- 0 496 656 



EP-A- 0 459 781 
EP-A- 0 507 669 



Note: Within nine months from the publication of the mention of the grant of the European patent, any person may give 
notice to the European Patent Office of opposition to the European patent granted. Notice of opposition shall be filed in 
a written reasoned statement. It shall not be deemed to have been filed until the opposition fee has been paid. (Art. 
99(1) European Patent Convention). 



Printed by Jouve. 75001 PARIS (FR) 



« 



1 EPO 

DeGcrlption 

BACKGROUND OF THE INVENTION 

[0001] The invention relates to a nnethod for effecting, 
with an electronic payment means, a variable number 
of payments in one payment transaction. More in par- 
ticular, the invention relates to a method for effecting a 
payment transaction with an electronic payment means 
and a payment station, comprising the issuing by the 
payment means to the payment station of at least a first 
payment value, payment values being representative 
for one or more payment units to be settled. Such a 
method is known, e.g. from European Patent Applica- 
tion EP-A-0,637,004. There are many types of payment 
transactions in which a variable number of payment 
units must be transferred. Thus, in a telephone booth, 
for a single conversation in most cases several units, 
corresponding with metering pulses (so-called "ticks"), 
should be debited against a payment card. These units 
are credited to the telephone set of the telephone booth. 
In the event of copiers, for a copying order a certain 
amount per page should be paid, with such amount be- 
ing capable of being debited against a payment card. 
Within a single transaction (telephone conversation or 
copying order), therefore, a debiting of the payment 
means (i.e., the payment card] and a crediting of a pay- 
ment station (telephone set or copier) must repeatedly 
take place. 

[0002] In the event of modern, protected payment 
means, such as so-called "smart cards" or "chip cards', 
a protocol is applied to each debiting of the payment 
means (debit), in which the authenticity of the payment 
means and of the electronic money used is verified. An 
example of a verification schema using blind signatures 
Is disclosed in European Patent Application EP-A- 
0,518,365. Another scheme to verify electronic money 
is disclosed in European Patent Application EP-A- 
0,507,669, where payment units are provided with ran- 
dom "sequence numbers". Verification of the electronic 
money is effected by checking received sequence num- 
bers against a list of issued sequence numbers. How- 
ever, this type of verification still allows the electronic 
money to be duplicated and to possibly be spent more 
than once. 

[0003] A verification, however for each payment unit 
(metering pulse or copying price per page) requires a 
certain processing time. In the event o1, e.g., interna- 
tional telephone conversations, where the metering 
pulses (or ticks) follow each other rapidly, the process- 
ing of the payment units may give rise to problems and 
obstruct the execution of a protected payment. 
[0004] In order to solve this problem, prior to the ac- 
tual transaction several payment units might already be 
transferred from the payment means to the payment sta- 
tion. This has the drawback that restitution should take 
place in the event that not all payment units are used 
up. Payment afterwards, i.e., the transfer of payment 
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values from the payment means to the payment station 
following the transaction, has the drawback that the pay- 
ment may be sabotaged by removing the payment 
means (i.e. the smart card) prematurely 

5 

SUMMARY OF THE INVENTION 

[0005] The object of the Invention is to eliminate the 
above and other drawbacks of the prior art. and to pro- 

'0 vide a method which enables the effecting of a protected 
payment in a simple and rapid manner with a variable 
number of payment units, i.e. a number of payment units 
to be determined during the transaction. 
[0006] Another object of the invention is to provide a 

^5 method which allows a secure payment involving a min- 
imal amount of processing time. 
[0007] For this purpose, a method of the type referred 
to in the preamble is characterised In that the payment 
values are mutually related by a one-way function, in 

20 such a manner that the first payment value may be ob- 
tained from a further payment value by repeatedly ap- 
plying the function. By applying a one-way function, i.e., 
a function of which the inverse cannot viably be deter- 
mined, a very suitable check on the progress of the pay- 

25 ment transaction may be obtained without the need to 
repeatedly execute a complicated and therefore time- 
consuming verification process. 

[0008] After receiving a payment value, the payment 
station preferably checks, by applying the function, 
30 whether the payment value received is correct. This is 
possible since repeated application of the function pro- 
duces the first payment value. 
[0009] After receiving a payment value the payment 
station, by applying the function repeatedly, may addl- 
es tionally determine how many payment units the pay- 
ment value received represents. Per payment transac- 
tion one or more payment values nnay be transferred, a 
(last) payment value possibly representing several (pre- 
vious) payment values. The number of times the tunc- 
40 tion must be applied to obtain the preceding or first pay- 
ment value, is directly related to the number of payment 
values generated, but does not have to be equal to the 
number of Issued and thus transferred payment values. 
[0010] Together with at least the first payment value, 
4S authentication data is advantageously transferred from 
the payment means to the payment station. This authen- 
tication data, such as the identification code of the pay- 
ment means and/or the usen may be contained in the 
first payment value or precede it. 
so [0011] In a further embodiment of the method accord- 
ing to the invention, the payment station, after receiving 
a payment value, transfers a debit value to the payment 
means. The debit values may be used, directly after hav- 
ing been received by the payment means, for debiting 
55 a balance, e.g., by lowering a counter reading present 
in the payment means. It is also possible, however that 
after having been received by the payment means the 
debit values are collected and. at the end of the payment 
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transaction, are used for debiting a balance. In the latter 
case, the nnethod may progress more rapidly. 
[0012] In yet a further embodiment ot the method ac- 
cording to the invention, together with the debit value a 
count value is transferred from the payment station to 
the payment means, which count value represents the 
number of payment units to be debited. The count value 
may be one, but may also be greater than one. so that 
several payment units are debited simultaneously. The 
count value may lurthermore have been determined in 
advance, or be variable. Preferably, the count value is 
related to the number of times the one-way function is 
applied, e.g., to obtain the preceding or the first payment 
value. 

[001 3] In a yet another embodiment of the method in 
accordance with the invention the issued payment val- 
ues are used as proof in a settlement process to be car- 
ried out later. In this case, with the issued payment value 
(s) a payment is laid down while the settlement of pay- 
ment can take place at another time. Such a settlement 
can for example result in a summary invoice. 
[001 4] The method according to the invention enables 
to adjust as needed, during the transaction., the number 
ot payment values and thus the number ot payment 
units to be settled. 

EXEMPLARY EMBODIMENTS 

[001 5] The invention will be explained in greater detail 
below with reference to the Figures. 

Fig. 1 shows a smart card as may be used in the 
method of the present Invention. 

Fig. 2 schematically shows the integrated circuit of 
the smart card of Fig. 1 . 

Fig. 3 schematically shows a preferred embodi- 
ment of the method according to the inven- 
tion. 

Fig. 4 schematically shows successive function 
values of a one-way function. 

[0016] The smart card or tC card 1 shown by way of 
example in Fig. 1 comprises a substrate 2, in which an 

integrated circuit is embedded. The integrated circuit is 
provided with contacts 3 tor contacting a card reader or 
the like. It should be noted that the present invention 
can also be applied in the case of so-cailed contactless 
smart cards. 

[0017] The integrated circuit 10 shown schematically 
and by way ot example in Fig. 2 comprises a processor 
11, a memory 12 and an input/output circuit 13. The 
memory may comprise a volatile (RAM) memory part tor 
temporarily storing data and a non-volatile (ROM) mem- 
ory part for permanently or senni-permanently storing 
data. The latter part is preferably an EEPROM type 
memory. The data stored in the non-volatile part may 
contain both programming data (instructions, programs) 
and payment data, i.e. data relating to monetary trans- 
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actions. It will be understood that a separate memory 
(not shown) may be provided to store the instruction set 
of the processor 11. The input-output circuit 13 may 
communicate with external devices via contacts (not 
5 shown in Fig. 2), such as the contacts 3 shown in Fig. 
1 . The integrated circuit 10 may be contained in the card 
1 of Fig. 1. 

[0018] In Fig. 3. there is schematically shown, by way 
of example, an embodiment of the method according to 

TO the invention. A payment means (paying party) is re- 
ferred to by I, and a payment station or terminal (receiv- 
ing party) is referred to by II. Between the payment 
means I and the payment station II, during a payment 
transaction an exchange ot data takes place. It will be 

15 understood that the payment means (card) I may corre- 
spond with the smart card 1 shown in Fig. 1 . 
[0019] At the time to, there may take place an ex- 
change of initialisation values I (or Init). This exchange, 
which inter alia may relate to the identity of the payment 

20 station and/or the payment means, the type of transac- 
tion and the like, is not essential to the present invention. 
[0020] At the time t^, the payment means (card) I 
sends an authentication value A and a first payment val- 
ue to the payment station (terminal) II. The payment 

2S value piyi may, like the debit value R, be contained in the 
authentication value A or may be determined by the au- 
thentication value A, e.g. when A is constituted by a dig- 
ital signature on pfJ^, R and other transaction data. The 
payment value need therefore not constitute a sep- 

30 a rate value. 

[0021] After authentication, the payment station pro- 
vides access to the desired service or the desired prod- 
uct and saves the authentication value A and the pay- 
ment value as proof of payment, e.g. vis-ci-vis a 

35 banking institution. Alternatively, or one or more pos- 
sible subsequent values may sen/e as 
proof to later collect money from a consumer (compare 
so-called credit cards). In his context it should be noted 
that the settlement of the transaction is, in principle, in- 

40 dependent of the transaction proper and may be carried 
out at another time and another place. 
[0022] At the time tg, the payment station II sends a 
debit value R to the payment means, possibly accom- 
panied by a count value N. The count value N may have 

45 a previously determined fixed value, e.g.; one. In this 
case, the transfer of the count value N may be dis- 
pensed with, or may be effected only once (time 12). 
[0023] On the basis of the debit value R, one or more 
payment units are debited against a balance on the 

50 card, e.g., by lowering a counter reading (see also e.g. 
EP-A-0,637,004). This number of payment units to be 
debited may be predetermined, or may be referred to by 
the count value N. Also the debit value R may be pre- 
determined, because of which R is redundant and may 

55 be dispensed with. Instead of R^ , or R and N. a generic 
debit signal may be transferred, The debiting may take 
place directly or shortly after the time tg, or may be post- 
poned till the end of the transaction. In the latter case, 
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the payment means will be constructed in such a man- 
ner that this debiting takes place even if the transaction 
is prematurely interrupted. 

[0024] As a reaction to the receipt of the debit value 
R, or as a reaction to the receipt of an Interim request s 
(not shown in Fig. 3) from the payment station, at the 
time t3 the payment means I sends a further payment 
value, Pf^.^, to the payment station II. In the payment 
station II, A and are now saved as proof of payment. 
In addition. F(pu|.i) is calculated; in other words, Is io 
subjected to the function F. If the result of this operation 
indeed produces (i^, not only has a check on the au- 
thenticity of piy^.-! been effected, but the number of pay- 
ment values Is also determined: the total number of pay- 
ment values is equal to the number of operations re- ^5 
quired to obtain plus one. It follows that in the event 
of receiving a payment value p^.^ the value of x may be 
determined by applying the function F x times. Thus, the 
count value N may be adjusted on the basis of the value 
of X found. This will be explained later with reference to 20 
Fig. 4. 

[0025] At the time 14, a further debit value R is trans- 
ferred from the payment station 1 1 to the payment means 
I, possibly together with a count value N. The payment 
means carries out similar operations as at the time tg. 
[0026] After the time X^, further similar steps may be 
carried out, or the transaction may be terminated. The 
transaction will be terminated anyway after the last pay- 
ment value pQ has been transferred. Possibly an ac- 
knowledgement of the termination of the transaction 
may be transferred from the payment station II to the 
payment means I. This Is not further indicated in Fig. 3. 
[0027] As is explained above, the number of payment 
units to be debited is variable and may depend on the 
duration of the transaction, inter alia. 
[0028] In summary, the method according to the in- 
vention, at any rate if use is made of debit values, com- 
prises the following steps: 

1 . The payment means sends a value p to the pay- 
ment station. 

2. The payment station sends a debit value to the 
payment means. 

3. The payment means sends a value of (p') derived 
from p, determined with the help of the one-way 
function, to the payment station. 

4. The payment station checks whether the re- 
ceived value P' is indeed a value derived from p. 

5. If the transaction has not been terminated, p is 
replaced by its derived value P', and the process 
continues at step 2. 

The derived value referred to here is always the value 
P' for which: 

F(P') = p. i.e. the value "preceding" p. 
[0029] It should be noted that the method described 
above may also be terminated after step 2, that is in case 
only one payment unit, such as a telephone tick (meter- 



ing pulse), is to be transferred. 
[0030] The payment values p referred to above may 
each represent one payment unit, such as a telephone 
tick, currency unit or calculation unit. It Is also possible, 
however, that each payment value represents several 
payment units, or that different payment values repre- 
sent different numbers of payment units. This may be 
recorded in the authentication value A. The first pay- 
ment value may e.g. represent a base rate of several (e. 
g., two or three) payment units, while further payment 
values always represent one payment unit. In this man- 
ner, a differentiation may be made between, e.g., the 
set-up costs and the duration costs of a telephone con- 
nection. The payment values consist of numbers which 
are transferred in the form of electrical, optical or acous- 
tical signals. 

[0031] The so-called one-way function F perse is sim- 
ple to calculate, but the inverse (F'"") cannot viably be 
determined. This Is understood to mean that in practice 
it is extremely unlikely that a value p|^_i may be deter- 
mined from a value pf^. Such a one-way function, known 
per se from cryptography may be constructed, e.g., by 
involution modulo a certain number, in which that spe- 
cific number may be a so-called 'Blum Integer", i.e. a 
product of two large prime numbers in a special form. A 
so-called "hash" function may also be applied. 
[0032] In Fig. 4, the application of the one-way func- 
tion is further illustrated with reference to an example. 
In this example, M is equal to 5 (see also Fig. 3), so that 
the first payment value is P5. In practice. M will have a 
much greater value, e.g.. 255. 
[0033] A value Pj (1=0... 5) may simply be calculated 
from the value p|.-, by applying the one-way function F: 
F(p|.-,)=pj. Conversely, it is very difficult to determine the 
inverse of F, so that in practice it is not viable to deter- 
mine the value Pj.^ from pj. In the method according to 
the Invention, this provides a form of guarantee: the pay- 
ment station is able to check whether the value p| is cor- 
rect and what is the (relative) value thereof by applying 
the function F several times. Conversely, the payment 
station itself is not able to calculate the next payment 
value, which represents a greater number of payment 
units. 

[0034] As may be seen from Fig. 4, the value P5 may 
be obtained from P2 by applying the function F three 
times. If the payment station first receives Pg and then 
P2. it may therefore be determined that P2 is the fourth 
payment value (relative to pg) and, e.g., represents four 
payment units (i.e. the units associated with P5 plus P4 
plus P3 plus P2). In response thereto, e.g., a count value 
N-4 may be transferred to the payment means in order 
to debit four payment units at once. If no value P5 results 
after the function F has been applied at most M (in this 
case 5) times to P2, it may be concluded that the most 
recently received value (i.e. P2) is invalid, as the values 
p5 and P2 are apparently not related by F. 
[0035] The possession of a valid p2 therefore demon- 
strates that the receiver (the payment station) is entitled 
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to payment units corresponding to four payment values: 
p2 through P5. These may be four payment units but. a. 
g., also four times C payment units, where C is a con- 
version factor. 

[0036] As explained above, the use of a one-way 
function provides a simple and rapid method for effect- 
ing payments with a variable number of payment units. 
This may not only be advantageous in the case of te- 
lephony, but for example also in the case of vending ma- 
chines, taximeters, and other devices where the amount 
to be settled can be dependent on the time duration. 
[0037] The payment values issued need not be set- 
tled, for example by means of debit values, during or 
immediately afterwards a transaction with a payment 
means, but may be used as proof in a settlement proc- 
ess to be carried out at a later time. In this case a pay- 
ment is laid down with the issued payment means, while 
the settlement of the payment can take place at a later 
time (incontestable charging). Such a settlement may 
for example result in a summary invoice with several 
transactions being settled in one settlement process. 
Using payment values as proof for settlements after- 
wards, can for example be used with mobile telephone 
and video distribution services (video-on-demand). 
[0038] The invention may be applied with or without 
so-called electronic 'cheques' comprising an electronic 
"signature" (e.g., a cryptographic operation with a spe- 
cific key on certain data) of the bank and/or the user. 
[0039] It will be understood by those skilled in the art 
that the invention is not limited to the embodiments 
shown, and that many modifications and amendments 
are possible without departing from the scope of the in- 
vention as defined in the appended claims. 



Claims 

1 . Method for effecting a payment transaction with an 
electronic payment means (1,1) and a payment sta- 
tion (II), comprising the issuing by the payment 
means to the payment station of at least a first pay- 
ment value (p|^), payment values being represent- 
ative for one or more payment units to be settled. 
characterised in that each subsequent payment val- 

(Pm-1' Pm-2« • •) related to the first payment val- 
ue {pi/^) by a one-way function (F) in such a manner 
that the first payment value (P^J^) may be obtained 
from a further payment value (P^.x) by repeatedly 
applying the function (F). 

2. Method according to claim 1, wherein the payment 
station (II), after receipt of a payment value (p|), 
checks by applying the function (F) whether the 
payment value received Is correct. 

3. Method according to claim 1 or 2, wherein the pay- 
ment station (II), after receipt of a payment value 
(Pi), determines by applying the function (F) how 



many payment units the payment value received 
represents. 

4. Method according to any of the preceding claims, 
5 wherein authentication data (A) is transferred to- 
gether with at least the first payment value (P,^) from 
the payment means (I) to the payment station (II). 

5. Method according to any of the preceding claims, 
TO wherein the payment station (II), after receipt of a 

payment value (P|), transfers a debit value (R) to the 
payment means. 

6. Method according to claim 5, wherein debit values 
T5 (R) are used, directly after receipt by the payment 

means (I), for debiting a balance. 

7. Method according to claim 5. wherein debit values 
(R), after receipt by the payment means (I), are col- 

20 lected and, at the end of the payment transaction, 
are used for debiting a balance. 

8. Method according to any ot the claims 5 up to and 
including?, wherein a count value (N) is transferred. 

25 together with the debit value (R), from the payment 
station (11) to the payment means (I), which count 
value (N) represents the number of payment units 
to be debited. 

30 9. Method according to claim 8. wherein the count val- 
ue (N) is related to the number of times the one-way 
function (F) has been applied. 

10. Method according to claim 8. wherein the count val- 
3S ue (N) amounts to one. 

11. Method according to any of the claims 1 up to and 
including 4, wherein the payment values (pj) Issued 
are used as proof in a settlement process to be car- 

40 ried out later. 

12. Payment means (1, I) provided with an integrated 
circuit (10), such as a so-called smart card, the in- 
tegrated circuit (10) being arranged for effecting a 

45 payment transaction with a payment station (II) by 
issuing to the payment station (I!) at least a first pay- 
ment value (Pi^), payment values being represent- 
ative for one or more payment units to be settled, 
characterised in that each subsequent payment val- 
50 ue(P^^.i, Pf^.2. . .) is related to the first payment val- 
ue (p^) by a one-way function (F) in such a manner 
that the first payment value (p^^i) may be obtained 
from a further payment value (P^.^) by repeatedly 
applying the function (F). 

55 

13. Payment means according to claim 12, further ar- 
ranged for transferring, together with at least the 
first payment value (Pivi), authentication data (A) to 
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the payment station (II). 

1 4. Payment means according to claim 1 2 or 1 3^ tu rther 
arranged for receiving and collecting debit and/or 
count values (R, N) from the payment station (II) 
and for debiting a balance at the end of the payment 
transaction with an amount represented by said val- 
ues (R, N). 



Patentanspruche 

1. Verfahren zum Durchfuhren einer Zahlungstrans- 
aktlon mil elnem elektronlschen Zahlungsmittel (1, 
I) und mit einer Zahlungsstation (II), mit der Ausga- 
be von mindestens einem ersten Zahlungswert (P|^) 
von dem Zahlungsmittel an die Zahlungsstation. 
wobei Zahlungswerte reprasentativ fOr eine Oder 
mehrere zu bezahlende Zahlungseinheiten sind, 
dadurch gekennzeichnet, dass jeder nachfolgen- 
de Zahlungswert (Pm.i. Pm.2) ersten Zah- 
lungswertdurch eine Ein-Weg-Funktion (F) Insolch 
einer Weise verbunden ist, dass der erste Zah- 
lungswert (p|^) aus elnem weiteren Zahlungswert 
(Pm-x) durch wiederholtes Anwenden der Funktion 
(F) erhalten werden kann. 

2. Verfahren nach Anspruch 1 , dadurch gekennzeich* 
net, dass die Zahlungsstation (II) nach Empfang ei- 
nes Zahlungswertes ((3j) durch Anwenden der Funk- 
tion (F) uberpruft. ob der empfangene Zahlungs- 
wert richtig ist. 

3. Verfahren nach Anspruch 1 oder Anspruch 2, da- 
durch gekennzeichnet, dass die Zahlungsstation 
(H) nach Empfang eines Zahlungswertes (Pj) durch 
Anwenden der Funktion (F) feststellt, wie viele Zah- 
lungseinheiten der empfangene Zahlungswert dar- 
stellt. 

4. Verfahren nach einem der vorstehenden AnsprO- 
che, dadurch gekennzeichnet, dass Authentifizie- 
rungsdaten (A) zusammen mit mindestens dem er- 
sten Zahlungswert (P|^) von dem Zahlungsmittel (I) 
an die Zahlungsstation (II) Qbertragen werden. 

5. Verfahren nach einem der vorstehenden Anspru- 
che, dadurch gekennzeichnet, dass die Zahlungs- 
station (II) nach Empfang eines Zahlungswertes (Pj) 
einen Belastungswert (R) an das Zahlungsmittel 
ubermittelt. 

6. Verfahren nach Anspruch 5, dadurch gekennzeich- 
net, dass Betastungswerte (R) direkt nach dem 
Empfang durch das Zahlungsmittel (I) zur Bela- 
stung eines Guthabens eingesetzt werden. 

7. Verfahren nach Anspruch 5, dadurch gekennzeich- 
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net, dass Belastungswerte (R) nach dem Empfang 
durch das Zahlungsmittel (I) gesammelt werden 
und bei der Beendigung der Zahlungstransaktion 
zur Belastung eines Guthabens eingesetzt werden. 

5 

8. Verfahren nach einem der Anspruche 5 bis 7,. da- 
durch gekennzeichnet, dass zusammen mit dem 
Belastungswert (R) ein Zahlwert (N) von der Zah- 
lungsstation (II) an das Zahlungsmittel (I) ubertra- 

10 gen wird. wobei der Zahlwert (N) die Anzahl der zu 
belastenden Zahlungseinheiten darstellt. 

9. Verfahren nach Anspruch 8, dadurch gekennzeich- 
net, dass der Zahlwert (N) zur Anzahl der Anwen- 

15 dungen der Ein-Weg-Funktion (F) in Bezug steht. 

10. Verfahren nach Anspruch 8, dadurch gekennzeich- 
net, dass der Zahlwert (N) Eins ist. 

20 11. Verfahren nach einem der Anspruche 1 bis 4, da- 
durch gekennzeichnet, dass die ausgegebenen 
Zahlungswerte (pj) ats Beweis fur ein nachfolgend 
auszufuhrendes Bezahlungsverfahren eingesetzt 
werden. 

25 

12. Zahlungsmittel (1, 1) mit einem integrlerten Schalt- 
krels (10), wie eine sogenannte Smartcard, wobei 
der integrterte Schaltkreis (10) derart ausgestaltet 
ist. um eine Zahlungstransaktion mit einer Zah- 

30 lungsstation (II) durchzufuhren. indem mindestens 
ein erster Zahlungswert (p|^) an die Zahlungsstation 
ausgegeben wird, wobei Zahlungswerte reprasen- 
tativ fur eine oder mehrere zu bezahlende Zah- 
lungseinheiten sind, dadurch gekennzeichnet, 

35 dass jeder nachfolgende Zahlungswert (P^-v 
• -) f^'^ ersten Zahlungswert {f>^) durch 
eine Ein-Weg-Funktion (F) in solch einer Weise ver- 
bunden ist, dass der erste Zahlungswert (p,^) aus 
einem weiteren Zahlungswert (Bm-x) ciurch wieder- 

40 holtes Anwenden der Funktion (F) erhalten werden 
kann. 

13. Zahlungsmittel nach Anspruch 12, dadurch ge- 
kennzeichnet, dass es so ausgestaltet ist, um Au- 

^5 thentifizierungsdaten (A) zusammen mit minde- 
stens dem ersten Zahlungswert {p^^) an die Zah- 
lungsstation (II) zu Qbertragen. 

14. Zahlungsmittel nach Anspruch 12 Oder 13, dadurch 
50 gekennzeichnet, dass es weilerhin ausgestaltet ist. 

um Belastungswerte und/oderZahlwerte (R, N) von 
der Zahlungsstation zu ubermittein und um ein Gut- 
haben am Ende der Zahlungstransaktion mit der 
durch die genannten Werte (R. N) reprasentlerlen 
55 Qeldwerte zu belasten. 
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Revendications 

1. Proc6d6 d'execution d'une transaction de paiement 
avec un moyen electronlque de paiement (1, I) a 
une station de paiement (11), comprenant la deli- s 
vrance par le moyen de paiement k la station de 
paiement d'au molns une premiere valeur de paie- 
ment (Pm). Iqs valeurs de paiement etant represen- 
tatives d'une ou plusieurs unites de paiement ^ r6- 
gler, caract6rls6 en ce que chaque valeur ult6rieure to 
de paiement pj^.g, ...) est li^e ^ la premiere 
valeur de paiement (P,^) par une fonction univoque 

(F) de manlSre que la premiere valeur de paiement 
{p^) pulsse 6tre obtenue ^ partir d'une valeur sup- 
plementaire de paiement (P^-x) par application r6- t5 
pet^e de la fonction (F). 

2. Proc6d6 selon la revendlcatlon 1, dans lequel la 
station de paiement (II), apr6s reception d'une va- 
leur de paiement (pj), v6rifie. par application de la 20 
fonction (F), si la valeur de paiement re9ue est con- 
venable. 

3. Precede selon la revendlcatlon 1 ou 2, dans lequel 

la station de paiement (II), apr6s r6ception d'une va- 25 
leur de paiement (pj), determine, par application de 
la fonction (F), combien d'unit^s de paiement reprd- 
sente la valeur de paiement regue. 

4. Precede selon I'une quelconque des revendications 30 
pr6cedentes, dans lequel des donnees d'authenti- 
fication (A) sont transferees avec au molns une pre- 
miere valeur de paiement (P|^) k partir du moyen de 
paiement (I) k la station de paiement (II). 

35 

5. Proc6d6 selon Tune quelconque des revendications 
pr^cedentes, dans lequel la station de paiement (II), 
apres reception d'une valeur de paiement (Pj), 
transffere une valeur de d^bit (R) au moyen de paie- 
ment. 40 

6. Proc6d6 selon la revendlcatlon 5, dans lequel les 
valeurs de d^bit (A) sont utilis^es dl rectement apr^ 
reception par le moyen de paiement (I) pour ie ddbit 
d'un solde. 4S 

7. Proc6d6 selon la revendlcatlon 5, dans lequel les 
valeurs de debit (R), aprds reception par le moyen ■ 
de paiement (I), sont collectdes et, k la fin de la tran- 
saction de paiement, sont utilisdes pour le d^blt so 
d'un solde. 

8. Procede selon I'une quelconque des revendications 
5^7 incluse, dans lequel une valeur de comptage 

(N) est transfdrde avec la valeur de dSbit (R) depuis ss 
la station de paiement (II) au moyen de paiement 
(I), cette valeur de comptage (N) repr6sentant le 
nombre d'unit^s de paiement k d^biter. 
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9. Procddd selon la revendlcatlon 8, dans lequel la va- 
leur de comptage (N) est Ii6e au nombre de fois ou 
la fonction univoque (F) a 6te appliquee. 

10. Proc6d6 selon la revendlcatlon 8, dans lequel la va- 
leur de comptage (N) est 6gale k 1 . 

11. Proc§d6 selon I'une quelconque des revendications 
1 k 4 incluse, dans lequel les valeurs de paiement 
(Pi) qui sont delivrees sont utills^es comme preuve 
d'une operation de rdglement ex^ut^e ult^rleure- 
ment. 

12. Moyen de paiement (1, I) muni d'un circuit integre 
(10), tel qu'une carte Electronlque, le circuit int6gr6 
(10) etant destine k effectuer une transaction de 
paiement avec une station de paiement (II) par de- 
livrance S la station de paiement (II) d'au moins une 
premiere valeur de paiement (p^^), les valeurs de 
paiement etant representatives d'une ou plusieurs 
unites de paiement k regler, caract6ris6 en ce que 
chaque valeur ult6rieure de paiement (Pf^.,, 
Pm-2' •••) ^ Is premiere valeur de paiement 
(Pi^) par une fonction univoque (F) de maniere que 
la premifere valeur de paiement (Pj^i) puisse 6tre ob- 
tenue k partir d'une valeur supplEmentaire de paie- 
ment (Pm-x) paf application r6p6t§e de la fonction 
(F). 

13. Moyen de paiement selon la revendlcatlon 12. des- 
tine en outre k transferer, avec au moins la premi6re 
valeur de paiement (Pi^), des donnees d'authentifi- 
catlon (A) k la station de paiement (II). 

14. Moyen de paiement selon la revendlcatlon 12 ou 
13, destine en outre k recevoir et collecter des va- 
leurs de debit et/ou de comptage (R, N) provenant 
de la station de paiement (II) et a d^biter un solde 
a la fin de la transaction de paiement avec une som- 
me representee par les valeurs R, N. 
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